clean up changelog and todo file

      service descriptor databases even when DirPort is zero. Bugfix

      on 0.1.2.x.

    - We were ignoring our RelayBandwidthRate for the first 30 seconds

      after opening a circuit -- even relayed circuits. Bugfix on

      after opening a circuit -- even a relayed circuit. Bugfix on

      0.2.0.3-alpha.

    - Stop thinking that 0.1.2.x directory servers can handle "begin_dir"

      requests. Should ease bugs 406 and 419 where 0.1.2.x relays are

      crashing or mis-answering these requests.

      crashing or mis-answering these types of requests.

    - Relays were publishing their server descriptor to v1 and v2

      directory authorities, but they didn't try publishing to v3-only

      authorities. Fix this; and also stop publishing to v1 authorities.

      Bugfix on 0.2.0.x.

    - When we were reading router descriptors from cache, we were ignoring

      the annotations -- including reading in bridge-purpose descriptors

      as general-purpose descriptors.

      the annotations -- so for example we were reading in bridge-purpose

      descriptors as general-purpose descriptors. Bugfix on 0.2.0.8-alpha.

    - When we decided to send a 503 response to a request for servers, we

      were then also sending the server descriptors: this defeats the

      whole purpose. Fixes bug 539; bugfix on 0.1.2.x.

  o Major features:

    - Bridges now behave like clients with respect to time intervals for

      downloading new consensus documents. Bridge users now wait until

      the end of the interval, so their bridge will be sure to have a

      new consensus document.

    - Bridge relays now behave like clients with respect to time

      intervals for downloading new consensus documents -- otherwise they

      stand out. Bridge users now wait until the end of the interval,

      so their bridge relay will be sure to have a new consensus document.

    - Three new config options (AlternateDirAuthority,

      AlternateBridgeAuthority, and AlternateHSAuthority) that let the

      user selectively replace the default directory authorities, rather

      than the all-or-nothing replacement that DirServer offers.

      user selectively replace the default directory authorities by type,

      rather than the all-or-nothing replacement that DirServer offers.

    - Tor can now be configured to read a GeoIP file from disk in one

      of two formats. This can be used by controllers to map IP addresses

      to countries. Eventually, it may support exit-by-country.

      where Tor is blocked.

    - Bridge directory authorities now do reachability testing on the

      bridges they know. They provide router status summaries to the

      controller on "getinfo ns/purpose/bridge", and also dump summaries

      controller via "getinfo ns/purpose/bridge", and also dump summaries

      to a file periodically.

    - Stop fetching directory info so aggressively if your DirPort is

      on but your ORPort is off; stop fetching v2 dir info entirely.

      huge. Otherwise we'll cache them all over the network and it'll

      clog everything up. Reported by Aljosha Judmayer.

    - Check for presence of s6_addr16 and s6_addr32 fields in in6_addr

      via autoconf.  Should fix compile on solaris.

      via autoconf. Should fix compile on solaris. Bugfix on 0.2.0.x.

    - When the DANGEROUS_VERSION controller status event told us we're

      running an obsolete version, it used the string "OLD" to describe

      it. Yet the "getinfo" interface used the string "OBSOLETE". Now use

      "OBSOLETE" in both cases.

      "OBSOLETE" in both cases. Bugfix on 0.1.2.x.

    - If we can't expand our list of entry guards (e.g. because we're

      using bridges or we have StrictEntryNodes set), don't mark relays

      down when they fail a directory request. Otherwise we're too quick

      to mark all our entry points down.

      to mark all our entry points down. Bugfix on 0.1.2.x.

    - Fix handling of hex nicknames when answering controller requests for

      networkstatus by name, or when deciding whether to warn about unknown

      routers in a config option. Bugfix on 0.1.2.x. (Patch from mwenge.)

    - Fix a couple of hard-to-trigger autoconf problems that could result

      in really weird results on platforms whose sys/types.h files define

      nonstandard integer types.

    - Fix compilation with --disable-threads set.

    - Authorities decide whether they're authoritative for a given router

      based on the router's purpose.

      nonstandard integer types. Bugfix on 0.1.2.x.

    - Fix compilation with --disable-threads set. Bugfix on 0.2.0.x.

    - Don't crash on name lookup when we have no current consensus.  Fixes

      bug 538; bugfix on 0.2.0.x.

    - When we decide to send a 503 response to a request for servers, do

      not then also send the server descriptors: this defeats the whole

      purpose.  Fixes bug 539; bugfix on 0.1.2.x.

    - Only Tors that want to mirror the v2 directory info should

      create the "cached-status" directory in their datadir. All Tors

      used to create it. Bugfix on 0.1.2.x.

      create the "cached-status" directory in their datadir. (All Tors

      used to create it.) Bugfix on 0.2.0.9-alpha.

    - Directory authorities should only automatically download Extra Info

      documents if they're v1, v2, or v3 authorities.

      documents if they're v1, v2, or v3 authorities. Bugfix on 0.1.2.x.

  o Minor features:

    - On USR1, when dmalloc is in use, log the top 10 memory

    - On the USR1 signal, when dmalloc is in use, log the top 10 memory

      consumers. (We already do this on HUP.)

    - Authorities and caches fetch the v2 networkstatus documents

      less often, now that v3 is encouraged.

      addresses.

    - Allow multiple HashedControlPassword config lines, to support

      multiple controller passwords.

    - Authorities now decide whether they're authoritative for a given

      router based on the router's purpose.

    - New config options AuthDirBadDir and AuthDirListBadDirs for

      authorities to mark certain relays as "bad directories" in the

      networkstatus documents. Also supports the "!baddir" directive in

        D Deferred

        X Abandoned

For Tor 0.2.0.13-alpha:

For Tor 0.2.0.x-rc:

  - Put a consensus in place of the empty fallback-consensus file in

    src/config and see what breaks.

  - let bridges set relaybandwidthrate as low as 5kb

  - config option FetchDirInfoEagerly so the dnsel can fetch dir

    info like a mirror without needing to be a tor server.

    - nick has to pick a name for it

  - we need a config option to turn off proposal 109 behavior, else

    running a private tor network on your own computer is very hard.

  - Make BEGIN_DIR mandatory for asking questions of bridge authorities?

    (but only for bridge descriptors. not for ordinary cache stuff.)

Features blocking 0.2.0.x:

  - mirror tor downloads on (via) tor dir caches

R   . spec

    d deploy

  . geoip caching and publishing for bridges

R   . spec

    . spec

    . Implement

      o Code to load a geoip file from disk

        o Truncated format

    - Mention in control-spec.txt

    d let Vidalia use the geoip data too rather than doing its own

      anonymized queries

  o bridge address disbursal strategies

    o get the cached-descriptors* to bridges@moria

    o parse out bridge addresses from cached-descriptors*

      (or parse them out before Tonga sends them)

      (or get Tonga's Tor to write them out better in the first place)

    o answer by IP/timestamp

      o run a little web server on moria?

    o answer by answering email to bridges@torproject

      o keep track of which addresses have been answered already

R - bridge communities

    - spec

    - deploy

    . spec

    . deploy

      - man page entries for Alternate*Authority config options

      - make the Alternate*Authority config options pass a "default_type"

      o make the Alternate*Authority config options pass a "default_type"

        to parse_dir_server_line() so they don't demand as much redundancy

      d some sort of reachability testing on bridges

  - interface for letting soat modify flags that authorities assign

R   . spec

    o add an AuthDirBadexit torrc option if we decide we want one.

      o some sort of reachability testing on bridges

      - a dir-based way to fetch the bridge networkstatus list

      - there's a config option with a password and somehow use an

        http header and check it

      - clients who have a password configured decide to ask their bridge

        authority for a networkstatus

      - be able to have bridges that aren't in your torrc

  d interface for letting soat modify flags that authorities assign

    . spec

S * tor usb windows image (vidalia, polipo, tor, firefox)

S/M - vidalia can launch firefox

S/M o vidalia can launch firefox

    - build a community version of firefox

    - pick our favorite extensions

    . pick our favorite extensions

Things we'd like to do in 0.2.0.x:

  - document the "3/4 and 7/8" business in the clients fetching consensus

          it couldn't fetch any network statuses, and never tried again

          even when the network came back and arma clicked on things.

          also 0.2.0.

      - we need a config option to turn off proposal 109 behavior, else

        running a private tor network on your own computer is very hard.

      . man page entry for HidServDirectoryV2 and

        MinUptimeHidServDirectoryV2.

      d Tor logs the libevent version on startup, for debugging purposes.

    - Refactor networkstatus generation:

      - Include "v" line in getinfo values.

  - Bridges:

  * Bridges:

    . Bridges users (rudimentary version)

      o Ability to specify bridges manually

      o Config option 'UseBridges' that bridge users can turn on.

        descriptor arrives

      o be more robust to bridges being marked as down and leaving us

        stranded without any known "running" bridges.

    - Bridges operators (rudimentary version)

      o Ability to act as dir cache without a dir port.

      o Bridges publish to bridge authorities

      o Fix BEGIN_DIR so that you connect to bridge of which you only

        know IP (and optionally fingerprint), and then use BEGIN_DIR to learn

        more about it.

R     - look at server_mode() and decide if it always applies to bridges too.

    - Bridges

      o Clients can ask bridge authorities for updates on known bridges.

    - Misc

      * Make BEGIN_DIR mandatory for asking questions of bridge authorities?

        (but only for bridge descriptors. not for ordinary cache stuff.)

  - Features (other than bridges):

    - Audit how much RAM we're using for buffers and cell pools; try to

    - Base relative control socket paths on datadir.

    - Make TrackHostExits expire TrackHostExitsExpire seconds after their

       *last* use, not their *first* use.

    - Limit to 2 dir, 2 OR, N SOCKS connections per IP.

    D Limit to 2 dir, 2 OR, N SOCKS connections per IP.

      - Or maybe close connections from same IP when we get a lot from one.

      - Or maybe block IPs that connect too many times at once.